The British government introduced landmark legislation on November 4 to provide UK law enforcement and the security and intelligence agencies with additional investigatory powers to fight crime in the digital age.
Under the plans, warrants for the most intrusive powers available to the agencies, such as the interception of communications, will be subject to a “double-lock," requiring approval by a judge as well as by the Secretary of State.
The draft legislation includes provisions on each of the key capabilities available to the intelligence agencies and others: communications data; interception; and equipment interference.
It also provides for the retention of Internet connection records (ICRs) — which law enforcement agencies need to restore eroding capabilities — although access to the data will be tightly controlled.
Law enforcement access to the information would be on a case-by-case basis where it’s necessary and proportionate to do so in the course of an individual investigation, limited to three rigidly defined purposes.
These purposes are to identify what device had sent an online communication, establish what online communications services a known individual had accessed, or identify whether a known individual had accessed illegal services online.
ICRs are the Internet equivalent of a phone bill — a record of the communication services a computer or a Smartphone connects to, but not people’s full browsing history. ICRs — a form of communications data — would let law enforcement see a person has visited google.co.uk or Facebook.com, but not what searches have been made on Google or whose profiles had been viewed.
Local authorities will be banned from accessing ICRs for any purpose.
The legislation will be subject to a new oversight regime which will be led by an Investigatory Powers Commissioner who is a senior judge. Currently, oversight arrangements are split across three different bodies.
Home Secretary Theresa May said in a statement that the draft bill will set out all of the agencies’ powers to acquire data in bulk, including their ability to acquire communications data relating to both the UK and overseas in bulk from communications services providers. She announced the government’s intention to place the capability on a more transparent footing through the Investigatory Powers Bill and to make it subject to the same robust safeguards as other bulk powers, including the “double-lock” authorization process.
The legislation responds to huge changes in communication, and seeks to ensure there are no “no go” areas of the Internet for law enforcement so the entirety of cyberspace can be policed in the face of technological advances.
“The publication of our draft Investigatory Powers Bill is a decisive moment," May said, adding, "never before has so much information been in the public domain about the activities of our police and security services, as well as the oversight, safeguard and authorization arrangements which govern them."
"I am clear we need to update our legislation to ensure it is modern, fit for purpose and can respond to emerging threats as technology advances," May said, adding, "There should be no area of cyberspace which is a haven for those who seek to harm us to plot, poison minds and peddle hatred under the radar.
"But I am also clear that the exercise and scope of investigatory powers should be clearly set out and subject to stringent safeguards and robust oversight," May continued.
The British government held more than 60 meetings with industry, civil liberties groups and other organizations to inform its policy proposals, and engagement will continue throughout pre-legislative scrutiny.
The draft legislation will now go through full pre-legislative scrutiny before a revised Investigatory Powers Bill is laid before Parliament in spring 2016.
The opposition Labour Party is provisionally supporting the bill while scrutinizing the finer details. Public reception has so far been muted compared to previous counterterror legislation announcements. The Home Secretary’s assurance of safeguards has perhaps allayed some fears, but perhaps even more than that, in thepost-Snowden era the public accepts that some level of cyber surveillance is required in this environment of increased threats. After all, if citizens can be protected simply by allowing the government to see if they have visited Google, that seems a small price to pay.
Those who intend to cause harm know how to use the Internet expertly to achieve their aims, it is therefore sensible that governments the world over have the power to meet this challenge.
